Skip to content
Commit e7735c85 authored by Marios Makassikis's avatar Marios Makassikis Committed by Steve French
Browse files

cifsd: Update out_buf_len in smb2_populate_readdir_entry()



When processing a SMB2 QUERY_DIRECTORY request,
smb2_populate_readdir_entry() is called first to fill the dot/dotdot
entries. This moves the d_info->wptr pointer but out_buf_len remains
unchanged. As a result, reserve_populate_dentry() may end up writing
past the end of the buffer since the bounds checking is done on
invalid values.

Signed-off-by: default avatarMarios Makassikis <mmakassikis@freebox.fr>
Signed-off-by: default avatarNamjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 79caa960
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment